Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: November 2005

32 records · 0 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2005-3388
    32Monitor

    Cross-site scripting (XSS) vulnerability in the phpinfo function in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5 allows remote attackers to injec

    MediumCVSS 4.3Proof of conceptEPSS 48%

    php · phpNov 1, 2005

  • CVE-2005-3390
    50Plan

    The RFC1867 file upload feature in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when register_globals is enabled, allows remote attackers to mod

    HighCVSS 7.5Proof of conceptEPSS 65%

    php · phpNov 1, 2005

  • CVE-2005-3398
    40Plan

    The default configuration of the web server for the Solaris Management Console (SMC) in Solaris 8, 9, and 10 enables the HTTP TRACE method,

    MediumCVSS 4.3WeaponizedEPSS 13%

    sun · solarisNov 1, 2005

  • CVE-2005-3404
    33Monitor

    Multiple PHP file inclusion vulnerabilities in ATutor 1.4.1 through 1.5.1-pl1 allow remote attackers to include arbitrary files via the sect

    HighCVSS 7.5Proof of conceptEPSS 10%

    adaptive technology resource centre · atutorNov 1, 2005

  • CVE-2005-3486
    33Monitor

    Multiple format string vulnerabilities in Scorched 3D 39.1 (bf) and earlier allow remote attackers to execute arbitrary code via various (1)

    HighCVSS 7.5Proof of conceptEPSS 11%

    scorched 3d · scorched 3dNov 3, 2005

  • CVE-2005-3488
    34Monitor

    Scorched 3D 39.1 (bf) and earlier allows remote attackers to cause a denial of service (long loop and server hang) via a negative numplayers

    HighCVSS 7.8Proof of conceptEPSS 10%

    scorched 3d · scorched 3dNov 3, 2005

  • CVE-2005-3498
    40Plan

    IBM WebSphere Application Server 5.0.x before 5.02.15, 5.1.x before 5.1.1.8, and 6.x before fixpack V6.0.2.5, when session trace is enabled,

    MediumCVSS 4.3WeaponizedEPSS 11%

    ibm · websphere application serverNov 3, 2005

  • CVE-2005-3507
    24Monitor

    Directory traversal vulnerability in CuteNews 1.4.1 allows remote attackers to include arbitrary files, execute code, and gain privileges vi

    MediumCVSS 5.0Proof of conceptEPSS 12%

    cutephp · cutenewsNov 6, 2005

  • CVE-2005-3524
    46Plan

    Buffer overflow in the SSL-ready version of linux-ftpd (linux-ftpd-ssl) 0.17 allows remote attackers to execute arbitrary code by creating a

    CriticalCVSS 10.0Proof of conceptEPSS 21%

    linux-ftpd-ssl · linux-ftpd-sslNov 6, 2005

  • CVE-2005-3559
    26Monitor

    Directory traversal vulnerability in vmail.cgi in Asterisk 1.0.9 through 1.2.0-beta1 allows remote attackers to access WAV files via a ..

    MediumCVSS 5.0Proof of conceptEPSS 20%

    digium · asteriskNov 16, 2005

  • CVE-2005-3560
    35Monitor

    Zone Labs (1) ZoneAlarm Pro 6.0, (2) ZoneAlarm Internet Security Suite 6.0, (3) ZoneAlarm Anti-Virus 6.0, (4) ZoneAlarm Anti-Spyware 6.0 thr

    HighCVSS 7.5Proof of conceptEPSS 15%

    zonelabs · zonealarmNov 16, 2005

  • CVE-2005-3589
    47Plan

    Buffer overflow in FileZilla Server Terminal 0.9.4d may allow remote attackers to cause a denial of service (terminal crash) via a long USER

    HighCVSS 7.8WeaponizedEPSS 52%

    filezilla · filezilla server terminalNov 16, 2005

  • CVE-2005-3591
    33Monitor

    Macromedia Flash plugin (1) Flash.ocx 7.0.19.0 (Windows) and earlier and (2) libflashplayer.so before 7.0.25.0 (Unix) allows remote attacker

    HighCVSS 7.5Proof of conceptEPSS 10%

    macromedia · flash playerNov 16, 2005

  • CVE-2005-3595
    45Plan

    By default Microsoft Windows XP Home Edition installs with a blank password for the Administrator account, which allows remote attackers to

    CriticalCVSS 10.0No exploitEPSS 16%

    microsoft · windows xpNov 16, 2005

  • CVE-2005-3634
    25Monitor

    frameset.htm in the BSP runtime in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to log users out and redirect

    MediumCVSS 5.0Proof of conceptEPSS 17%

    sap · sap web application serverNov 16, 2005

  • CVE-2005-3644
    44Plan

    PNP_GetDeviceList (upnp_getdevicelist) in UPnP for Microsoft Windows 2000 SP4 and earlier, and possibly Windows XP SP1 and earlier, allows r

    HighCVSS 7.8Proof of conceptEPSS 42%

    microsoft · windows 2000Nov 17, 2005

  • CVE-2005-3116
    48Plan

    Stack-based buffer overflow in a shared library as used by the Volume Manager daemon (vmd) in VERITAS NetBackup Enterprise Server 5.0 MP1 to

    CriticalCVSS 10.0Proof of conceptEPSS 27%

    symantec veritas · netbackupNov 18, 2005

  • CVE-2005-3314
    50Plan

    Stack-based buffer overflow in the IMAP daemon in Novell Netmail 3.5.2 allows remote attackers to execute arbitrary code via "long verb argu

    HighCVSS 7.5WeaponizedEPSS 65%

    novell · netmailNov 18, 2005

  • CVE-2005-2629
    24Monitor

    Integer overflow in RealNetworks RealPlayer 8, 10, and 10.5, RealOne Player 1 and 2, and Helix Player 10.0.0 allows remote attackers to exec

    MediumCVSS 5.1Proof of conceptEPSS 12%

    realnetworks · helix playerNov 18, 2005

  • CVE-2005-3683
    51Plan

    Stack-based buffer overflow in freeFTPd before 1.0.9 with Logging enabled, allows remote attackers to cause a denial of service (application

    HighCVSS 7.5WeaponizedEPSS 71%

    freeftpd · freeftpdNov 18, 2005

  • CVE-2005-3684
    34Monitor

    Multiple buffer overflows in freeFTPd 1.0.8, without logging enabled, allow remote authenticated attackers to cause a denial of service (app

    HighCVSS 7.5Proof of conceptEPSS 13%

    freeftpd · freeftpdNov 18, 2005

  • CVE-2005-3694
    35Monitor

    centericq 4.20.0-r3 with "Enable peer-to-peer communications" set allows remote attackers to cause a denial of service (segmentation fault a

    HighCVSS 7.8Proof of conceptEPSS 11%

    centericq · centericqNov 20, 2005

  • CVE-2005-3737
    24Monitor

    Buffer overflow in the SVG importer (style.cpp) of inkscape 0.41 through 0.42.2 might allow remote attackers to execute arbitrary code via a

    MediumCVSS 5.1Proof of conceptEPSS 13%

    inkscape · inkscapeNov 21, 2005

  • CVE-2005-3745
    25Monitor

    Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web

    MediumCVSS 4.3Proof of conceptEPSS 25%

    apache · strutsNov 22, 2005

  • CVE-2005-3757
    42Plan

    The Saxon XSLT parser in Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to obtain sensitive inf

    HighCVSS 7.5WeaponizedEPSS 41%

    google · mini search applianceNov 22, 2005

  • CVE-2005-3758
    23Monitor

    Cross-site scripting (XSS) vulnerability in Google Mini Search Appliance, and possibly Google Search Appliance, allows remote attackers to i

    MediumCVSS 4.3No exploitEPSS 19%

    google · mini search applianceNov 22, 2005

  • CVE-2005-3774
    25Monitor

    Cisco PIX 6.3 and 7.0 allows remote attackers to cause a denial of service (blocked new connections) via spoofed TCP packets that cause the

    MediumCVSS 5.0Proof of conceptEPSS 18%

    cisco · pixNov 22, 2005

  • CVE-2005-3792
    43Plan

    Multiple SQL injection vulnerabilities in the Search module in PHP-Nuke 7.8, and possibly other versions before 7.9 with patch 3.1, allows r

    HighCVSS 7.5Proof of conceptEPSS 44%

    francisco burzi · php-nukeNov 24, 2005

  • CVE-2005-3862
    36Monitor

    Buffer overflow in unalz before 0.53 allows remote attackers to execute arbitrary code via long file names in ALZ archives.

    HighCVSS 7.5Proof of conceptEPSS 20%

    unalz · unalzNov 29, 2005

  • CVE-2005-2123
    48Plan

    Multiple integer overflows in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allow remot

    HighCVSS 7.5Proof of conceptEPSS 61%

    microsoft · windows 2000Nov 29, 2005

  • CVE-2005-2124
    47Plan

    Unspecified vulnerability in the Graphics Rendering Engine (GDI32.DLL) in Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1, related to

    HighCVSS 7.6Proof of conceptEPSS 55%

    microsoft · windows 2000Nov 29, 2005

  • CVE-2005-3912
    34Monitor

    Format string vulnerability in miniserv.pl Perl web server in Webmin before 1.250 and Usermin before 1.180, with syslog logging enabled, all

    HighCVSS 7.5No exploitEPSS 14%

    webmin · webminNov 30, 2005